Are there any simple and integrated (i.e. embedded into filesystem) ACL patches for Linux kernel exist at all?
The problem is simple: I need something more flexible and advanced beyond classic 'rwx' chmod on Linux.
My requirements are:
- Having more fragmented restrictions:
- At least permit user to delete, but not to create
- Reverse: permit create and append, but not delete
- Hide files from anyone except superuser and owner/group
- It is better to fragment those into separate permission flags
- Separated permissions for files and directories
- More advanced control over appending to files/directories
- Large number of permission entries going beyond standard user:group model (like POSIX ACL does)
- Being integrated into filesystem (perhaps via xattrs)
- Not requiring sophisticated and bloated programs and security frameworks (I already walked through grsecurity and I dislike it)
- Unified tools to manage them from userspace
The reason for that is a number of advanced file servers I usually build become very limited or insecure because there is only so limited POSIX ACL exist which only extends a number of 'rwx' entries on inode.
Things that are not apply here:
- Any Linux kernel LSM (SELinux etc.)
And as last resort, if there are no any packages/kernel patches providing such functionality, then I will be forced to start hacking my own.